Reputation Trust Feed Continues Creating Alerts After Being Disabled In The UI

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Reputation Trust SRS Feed creating alerts after being disabled in the EDR UI.

Environment

• Carbon Black EDR Server: All Versions

Resolution

1. Stop services: How to Start, Stop and Restart EDR Application Services
2. Start postgres service: 

   /usr/share/cb/cbservice cb-pgsql start

3. Identify the feed id for the feed to be deleted (this command prints all of them out): 

   psql -d cb -p 5002 -c "select id,name,display_name from alliance_feeds;"

4. Backup feed table from postgres:

   pg_dump -C -Fp -t alliance_feeds -f /var/log/cb/ea_14857_alliance_feeds.sql cb -p 5002

5. Delete feed from postgres: 

   psql -d cb -p 5002 -c "delete from alliance_feeds where id = '<feed_id>';"

6. Confirm that the feed is gone: 

   psql -d cb -p 5002 -c "select id,name,display_name from alliance_feeds;"

7. Stop postgres service: 

   /usr/share/cb/cbservice cb-pgsql stop

8. Start solr service: 

   /usr/share/cb/cbservice cb-solr start

9. See how many reports are in the feeds core for that feed id:

   curl "http://127.0.0.1:8080/solr/cbfeeds/select?q=feed_id:<feed_id>&wt=json&indent=true&rows=0"

10. If there are any reports, delete them:

    curl "http://127.0.0.1:8080/solr/cbfeeds/update/?commit=true" -H "Content-Type: text/xml" -d "<delete><query>(feed_id:<feed_id>)</query></delete>"

11. Confirm that the reports are gone:

    curl "http://127.0.0.1:8080/solr/cbfeeds/select?q=feed_id:<feed_id>&wt=json&indent=true&rows=0"

12. Stop solr service: 

    /usr/share/cb/cbservice cb-solr stop

13. Start all services: How to Start, Stop and Restart EDR Application Services
14. Use the cbfeed scrubber to remove exiting tags for the feed: 

    /usr/share/cb/cbfeed_scrubber --untag <feedname>

Additional Information

The feed should repopulate in Postgres and the UI after being deleted; it will have a new ID and should be disabled by default.